Add deterministic iteration runtime executor

[areshand]

Summary:

• seal one complete worker DAG per iteration and bind its digest into the supervisor authority capsule
• let the runtime schedule ready workers, finalize evidence, freeze the diff, derive required reviews, and complete lifecycle transitions without orchestrator turns between nodes
• preserve mandatory authority and technical review; add decision-drift only for material alternatives or assumptions; support safe repair TODO binding and idempotent retry
• update the ops-trace acceptance benchmark to require 100% correctness, 100% safety, zero runtime errors, and at least 30% lower mean and median latency

Verification:

• cargo test: 67 passed
• lifecycle shell tests: passed
• mock orchestration E2E: passed
• Python ops-trace and SWE outcome tests: 41 passed
• production ops-trace v2 full dataset: 24/24 correct, 24/24 safe, 0 runtime errors
• latency mean: 152.927s vs 294.050s before, 48.0% reduction
• latency median: 151.674s vs 278.984s before, 45.6% reduction
• agent count: exactly 3 per case vs 4 before

Trust boundary:

• orchestrator remains semantic planner only
• supervisor seals plan digest and derives non-removable review obligations
• authority review remains mandatory and digest-bound
• runtime cannot replan; findings return needs_replan for a new sealed iteration
• sanitized runtime traces contain no auth or Codex home data